HN user

it200219

6 karma
Posts1
Comments8
View on HN

They sent me an email, I dont know even unsubscribe page is not working, surprise to me I can see all DB details over here. Tears in my eyes on seeing these details are exposed to public.

<code> <?php 02 03 define('CRONJOB', TRUE); 04 include("index.php"); 05 06 $email = isset($_GET['email']) ? $_GET['email'] : ""; 07 $hash = md5("carbon".$email); 08 setcookie("guid", $hash, time() + (10 * 365 * 24 * 60 * 60), "/", "carbonhire.com"); 09 //print_r($_COOKIE); 10 header("Location: http://hastrk1.com/serve?action=click&publisher_id=59998&sit..., true, 302); 11 12 $link = mysql_connect('geniushire-real-1.cbuqrrbjabbr.us-east-1.rds.amazonaws.com', 'geniushire', ';kcvGayqe05t4!?'); 13 if (!$link) { 14 die('Could not connect: ' . mysql_error()); 15 } 16 17 mysql_select_db("geniushire_real_new", $link) or die('Could not select database.');$sql = "UPDATE gh_central SET cookie_id = '".$hash."' WHERE email = '".$email."'"; 18 if($email != ""){ 19 $sql = "UPDATE gh_central SET cookie_id = '".$hash."' WHERE email = '".$email."'"; 20 $r = mysql_query($sql); 21 } 22 ?>

</code>

I had installed "osCommerce - Open source E-Commerce platform" just like Magento on one of our client who had > 500 transactions a day.

Some how in settings, we had flag "Store Credit Card Info" as "Plain Text" enabled. The Admin/Staff of that client could have use this information to make transactions (As in Backend it would show Full CC info into order details)

We didnt realized untill we worked on it again for some bug fixes and adding new features.

Lesson Learned :- When transitioning from DEV to PROD env, make sure to check all these critical flags and correctly set

Luckily, the client didnt had any idea about what was wrong in backend.

Its becoming common now-a-days for recruiter to not to get back to you with one line - "Thank you for sending in your application".

There is no exception. I doubt even if they read application before clicking on "Delete" button.